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Detailed Action 

Claims 1-62 are pending in this Office Action. 

Information Disclosure Statement 

The information disclosure statement filed on 2/9/2004 has been considered. 

Specification 

The specification is objected to because the cross-referenced related application 10/640,870 
needs to be updated to the publication number or patent number. The attorney docket no. needs 
to be removed. Appropriate correction is required. 

Claim Objection 

Claim 1 is objected to for the minor wording in the preamble. The preamble states "a network 
data classifier configured to statistically classify data and comprising" and the examiner believes 
the use of the word 'and' is unwarranted and confusing. Removal of the word is requested. 

Claim Rejections - 35 USC § 112 

The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 
subject matter, which the applicant regards as his invention. 
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Claims 1, 3, 26-27 are rejected under 35 U.S.C. 1 12, second paragraph, as being 
indefinite for failing to particularly point out and distinctly claim the subject matter which 
applicant regards as the invention. 

Claim 1 recites the limitation "the data class" in the fourth limitation, line 9 th line. There 
is insufficient antecedent basis for this limitation in the claim. 

Claim 3 recites the limitation "a flow identifier coupled to the network interfaces" in the 
first limitation. There is insufficient antecedent basis for the plurality of "interfaces' in the claim. 

Claim 26 recites "the data flow multiplexer being coupled to the one or more of a 
plurality of network interfaces" There is insufficient antecedent basis for the "one or more of a 
plurality of network interfaces" in the claim. 

Claim 27 recites "it's second input terminal." There is insufficient antecedent basis for 
the "one or more of a plurality of network interfaces" in the claim. 

Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis 
for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public use or 
on sale in this country, more than one year prior to the date of application for patent in the United States. 

Claims 1, 10-16, 24; 40, 49-52, 60 are rejected under 35 U.S.C. 102(b) as being 
anticipated by U.S. Patent No. 6,119,236 by Shipley. 

Regarding claim 1, a network data classifier configured to statistically classify data (Shipley: col. 
3, lines 45-54) and comprising: 
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a network interface configured to receive packets carrying the data (Shipley: col. 5, lines 

24-32); 

a feature extraction hardware block coupled to the network interface and configured to 
extract at least one feature from the received data (Shipley: col. 5, lines 58- col. 6, line 2; Fig. 2, 
tags 34, 36); 

a statistical classifier coupled to the feature extraction and configured to statistically 
classify the data in accordance with the at least one extracted feature (Shipley: col. 7, lines 1-50); 
and 

a policy engine coupled to the statistical classifier and configured to define a rule 
corresponding to the data class (Shipley: col. 7, lines 51-56), wherein the statistical classifier is 
further configured to statistically classify the data at a same rate at which the network interface 
receives the packets (Shipley: col. 6, lines 4-14). 

Regarding claim 10, the network classifier of claim 1 wherein the feature extractor is 
programmable (Shipley: col, 8, lines 30-41). 

Regarding claim 1 1, the network classifier of claim 1 wherein the statistical classifier is 
programmable (Shipley: col. 4, lines 30-56; col. 7, lines 24-27). 

Regarding claim 12, the network classifier of claim 1 wherein the policy engine is programmable 
(Shipley: col. 7, lines 51-58). 

Regarding claim 13, the network classifier of claim 1 wherein the received data is one of 
messages, files, streams, documents, web pages, and e-mails (Shipley: col. 2, lines 43-56). 



Regarding claim 14, the network classifier of claim 1 wherein the network interface is 
configured to interface with at least one of an Ethernet network, a SONET network, and an ATM 
network (Shipley: col. 3, line 50). 
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Regarding claim 15, the network classifier of claim 1 wherein the packets are received via an 
Internet Protocol (IP) network (Shipley: col. 5, line 1-14). 

Regarding claim 16, the network classifier of claim 1 wherein the feature extraction hardware 
block is configured to match extract features against a database of textual patterns (Shipley: col. 
5, lines 58- col. 5, line 30). 

Regarding claim 24, the network classifier of claim 1 wherein the at least one feature is selected 
from a group consisting of indicator vector, histogram, multitude of statistics associated with the 
data, mathematical transformation, timing information, and network events (Shipley: col. 6, lines 
31-56). 

Regarding claim 40, a method for statistically classifying data (Shipley: col. 3, lines 45-54), the 
method comprising: 

receiving packets carrying the data (Shipley: col. 5, lines 24-32); 

extracting at least one feature from the received data (Shipley: col. 5, lines 58- col. 6, line 
2; Fig. 2, tags 34, 36); 

statistically classifying the data in accordance with the at least one extracted feature and 
at a same rate at which the packets are received (Shipley: col. 7, lines 1-50); and 

applying a rule corresponding to the data class (Shipley: col. 6, lines 4-14). 

Regarding claim 49. the method of claim 40 wherein the received data is one of messages, files, 
streams, documents, web pages, and e-mails (Shipley: col. 2, lines 43-56). 

Regarding claim 50, the method of claim 40 wherein the packets are received via one of an 
Ethernet network, a SONET network, and an ATM network (Shipley: col. 3, line 50). 

Regarding claim 5 1 , the method of claim 40 wherein the packets are received via an Internet 
Protocol (IP) network (Shipley: col. 5, line 1-14). 
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Regarding claim 52, the method of claim 40 further comprising: matching the extract features 
against a database of textual patterns (Shipley: col. 5, lines 58- col. 5, line 30). 

Regarding claim 60, the method of claim 40 wherein the at least one feature is selected from a 
group consisting of indicator vector, histogram, multitude of statistics associated with the data, 
mathematical transformation, timing information, and network events (Shipley: col. 6, lines 31- 
56). 

Claims 33-39 are rejected under 35 U.S.C. 102(b) as being anticipated by U.S Patent 
No. 5,253,330 by Ramacher. 

Regarding claim 33, an integrated circuit configured to perform wire-speed computations for use 
in statistical classification of network data (Ramacher: col. 6, lines 27-32), the integrated circuit 
comprising: 

a lookup table configured to store weights for a multitude of events associated with the 
network data (Ramacher: col. 2, lines 55-62); 

an adder coupled to add the weights it receives from the look-up table (Ramacher: col. 5, 
lines 36-43); 

a register configured to store a value (Ramacher: Fig. 1); 
an accumulator (Ramacher: col. 5, lines 36-43); and 

a multiplexer configured to deliver to the accumulator one of the added weights it 
receives from the adder at its first input terminal (Ramacher: col. 5, lines 36-43) and the value it 
receives from the register at its second input terminal, the accumulator further configured to 
supply a summation of the added weights to the adder (Ramacher: col. 5, lines 36-43). 

Regarding claim 34, the integrated circuit of claim 33 wherein said integrated circuit is a field 
programmable gate array (Ramacher: col. 13, lines 14-15). 
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Regarding claim 35, the integrated circuit of claim 33 furthermore comprising: a hardware logic 
block configured to apply a non-linear function to the summation stored in the accumulator 
(Ramacher: col. 5, lines 36-43). 

Regarding claim 36, the integrated circuit of claim 35 wherein the hardware logic block is 
configured to apply a non-linear function to the summation stored in the accumulator using 
lookup table (Ramacher: col. 5, lines 36-430. 

Regarding claim 37, the integrated circuit of claim 35 wherein the hardware logic block is 
formed in a programmable device (Ramacher: col. 2, line 33-34). 

Regarding claim 38, the integrated circuit of claim 35 wherein the register is programmable 
(Ramacher: col. 2, line 33-34). 

Regarding claim 39, the integrated circuit of claim 35 wherein the hardware logic block is 
programmable (Ramacher: col. 2, line 33-34). 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 



Claims 2, 41 are rejected under 35 U.S.C, 103(a) as being unpatentable by U.S. 
Patent No. 6,119,236 by Shipley in view of U.S Patent No. 6,167,047 by Welfeld (Applicant 
IDS). 



Regarding claim 2, the Shipley reference teaches the network classifier of claim 1. 
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The Shipley reference fails to teach the a rate of 100 Mbits/sec. 

However, the Welfeld reference teaches wherein the rate at which the packets are 
received is greater than or equal to 100 Mbits/sec (Welfeld: col. 1, lines 35-40; col. 2, lines 36- 
39) in order to provide high speed packet classification while overcoming limits in prior art state 
machines (Welfeld: col. 1, lines 40-41, col. 2, lines 31-34). 

It would have been obvious at the time of the invention to one of ordinary skill in the art 
to create the network classifier as taught by Shipley to include processing of speeds of 100 
Mbits/sec as taught by Welfeld in order to provide high speed packet classification while 
overcoming limits in prior art state machines (Welfeld: col. 1, lines 40-41, col. 2, lines 31-34). 

Regarding claim 41, the Shipley reference teaches the network classifier of claim 40. 

The Shipley reference fails to teach the a rate of 100 Mbits/sec. 

However, the Welfeld reference teaches wherein the rate at which the packets are 
received is greater than or equal to 100 Mbits/sec (Welfeld: col. 1, lines 35-40; col. 2, lines 36- 
39) in order to provide high speed packet classification while overcoming limits in prior art state 
machines (Welfeld: col. 1, lines 40-41, col. 2, lines 31-34). 

It would have been obvious at the time of the invention to one of ordinary skill in the art 
to create the network classifier as taught by Shipley to include processing of speeds of 100 
Mbits/sec as taught by Welfeld in order to provide high speed packet classification while 
overcoming limits in prior art state machines (Welfeld: col. 1, lines 40-41, col. 2, lines 31-34). 

Claim 3-9, 17, 25-26; 42-48, 53, 61-62 are rejected under 35 U.S.C. 103(a) as being 
unpatentable by U.S. Patent No. 6,119,236 by Shipley in view of U.S Patent Publication No. 
20020042274 by Ades. 

Regarding claim 3, the Shipley reference teaches the network classifier of claim 1. 
The Shipley reference fails to state reordering of packets. 
However, the Ades reference teaches 

a flow identifier coupled to the network interfaces and configured to identifying a flow to 
which each of the received packets belongs (Ades: pages 35-36, para 541); 
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a flow assembler coupled to the flow identifier and configured to reorder the received 
packets such that the order of the reordered packets matches the order in which they were 
transmitted (Ades: page 21, para 289); and 

a flow database configured to the flow assembler and configured to maintain a record for 
each identified flow (Ades: page 35-36, para 541) in order to allow messages to be put back in 
their original stream and take the shortest path across the network (Ades: page 21, para 289; page 
35, para 541). 

It would have been obvious at the time of the invention to one of ordinary skill in the art 
to create the network classifier as taught by Shipley to include flow identifiers and reordering of 
packets as taught by Ades in order to allow messages to be put back in their original stream and 
take the shortest path across the network (Ades: page 21, para 289; page 35, para 541). 

Regarding claim 4, the network classifier of claim 3 wherein the record for each identified flow 
includes at least one of an identification number, source and destination addresses of the received 
packets, protocol identification number, information used by the feature extraction hardware 
block and information used by the statistical classifier (Shipley: col. 7, lines 1-23; information 
being accessed). 

Regarding claim 5, the network classifier of claim 4 further comprising: a host interface 
configured to receive the packets from a host system (Shipley: col. 5, lines 24-32). 

Regarding claim 6, the network classifier of claim 4 further comprising: a host interface 
configured to receive the data from a host system (Shipley: col. 5, lines 24-32). 

Regarding claim 7, the network classifier of claim 5 wherein the host interface is coupled to a 
device selected from a group consisting of microprocessor and network processor (Shipley: col. 
9, lines 10-17). 

Regarding claim 8, the network classifier of claim 7 wherein the host system is selected from a 
group consisting of firewall (Shipley: col. 2, lines 6-24), router, switch, network appliance, 
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security system, anti-virus system, anti-spam system, intrusion detection system, content filtering 
system, mail server, web server, quality of service provisioner, and gateway. 

Regarding claim 9, the network classifier of claim 8 wherein the host system is coupled to at 
least one of the flow identifier, the flow assembler, the feature extraction hardware block, the 
statistical classifier, and the flow database via one or more application programming interface 
(Shipley: col. 5, lines 24-32; Fig. 1). 

Regarding claim 17, the network classifier of claim 3 wherein the statistical classifier is 
configured to correlate events between one or more data flows (Shipley: col. 6, lines 4-18). 

Regarding claim 25, the Shipley reference teaches the network classifier of claim 3. 

The Shipley reference fails to teach storing in a flow database. 

However, the Ades reference wherein the feature extraction hardware block stores a 
history of the data it receives in the flow database, said history being used to extract the features 
from the received data (Ades: page 35-36, para 541) in order to allow messages to take the 
shortest path across the network (Ades: page 35, para 541). 

It would have been obvious at the time of the invention to one of ordinary skill in the art 
to create the network classifier as taught by Shipley to include flow database as taught by Ades 
in order to allow messages to take shortest path across the network (Ades: page 35, para 541). 

Regarding claim 26, the Shipley reference teaches the apparatus of claim 3. 
The Shipley reference fails to state multiplexing. 
However, the Ades reference teaches: 

a data flow multiplexer, the data flow multiplexer being coupled to the one or more of a 
plurality of network interfaces (Ades: para 77, 289), the data flow multiplexer coupled to the one 
or more of a plurality of feature extraction devices, the data flow multiplexer providing for 
context switching between one or more of a plurality of data flows (Ades: page 21, 35 and para 
77, 289); and 
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a data flow context database, the data flow context database coupled to the data flow 
multiplexer, the data flow context database providing for retaining of state of said one or more of 
a plurality of data flows for said context switching (Ades: page 35-36, para 541) in order to allow 
messages to take the shortest path across the network (Ades: page 35, para 541). 

It would have been obvious at the time of the invention to one of ordinary skill in the art 
to create the network classifier as taught by Shipley to include flow identifiers and database as 
taught by Ades in order to allow messages to take shortest path across the network (Ades: page 
35, para 541). 

Regarding claim 42, the Shipley reference teaches the network classifier of claim 40. 
The Shipley reference fails to state reordering of packets. 
However, the Ades reference teaches: 

identifying a flow to which each of the received packets belongs (Ades: pages 35-36, 
para 541); reordering the received packets such that the order of the reordered packets matches 
the order in which they were transmitted (Ades: page 21, para 289); and maintaining a record for 
each identified flow (Ades: page 35-36, para 541) in order to allow messages to be put back in 
their original stream and take the shortest path across the network (Ades: page 21, para 289; page 
35, para 541). 

It would have been obvious at the time of the invention to one of ordinary skill in the art 
to create the network classifier as taught by Shipley to include flow identifiers and reordering of 
packets as taught by Ades in order to allow messages to be put back in their original stream and 
take the shortest path across the network (Ades: page 21, para 289; page 35, para 541). 

Regarding claim 43, the method of claim 42 wherein the record for each identified flow includes 
at least one of an identification number, source and destination addresses of the received packets, 
protocol identification number, information used for extracting the at least one feature extractor 
and information used to statistically classify the data (Shipley: col. 7, lines 1-23; information 
being accessed). 
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Regarding claim 44, the method of claim 43 further comprising: receiving the packets from a 
host system (Shipley: col. 5, lines 24-32). 

Regarding claim 45, the method of claim 43 further comprising: receiving the data from a host 
system (Shipley: col. 5, lines 24-32). 

Regarding claim 46, the method of claim 44 wherein the host system is selected from a group 
consisting of microprocessor and a network processor (Shipley: col. 9, lines 10-17). 

Regarding claim 47, the method of claim 46 wherein the host system is selected from a group 
consisting of firewall (Shipley: col. 2, lines 6-24), router, switch, network appliance, security 
system, anti-virus system, anti-spam system, intrusion detection system, content filtering system, 
mail server, web server, quality of service provisioner, and gateway. 

Regarding claim 48, the method of claim 46 further comprising: coupling the, host system to one 
or more application programming interfaces (Shipley: col. 5, lines 24-32; Fig. 1). 

Regarding claim 53, the method of claim 42 further comprising: correlating events between one 
or more data flows (Shipley: col. 6, lines 4-18). 

Regarding claim 61, the Shipley reference teaches the network classifier of claim 42. 
The Shipley reference fails to teach storing in a flow. 

However, the Ades reference the method of claim 42 further comprising: stores a history 
of the received data, said history being used to extract the features from the received data (Ades: 
page 35-36, para 541) in order to allow messages to take the shortest path across the network 
(Ades: page 35, para 541). 

It would have been obvious at the time of the invention to one of ordinary skill in the art 
to create the network classifier as taught by Shipley to include flow database as taught by Ades 
in order to allow messages to take shortest path across the network (Ades: page 35, para 541). 
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Regarding claim 62, the Shipley reference teaches the apparatus of claim 42. 
The Shipley reference fails to state multiplexing. 
However, the Ades reference teaches: 

multiplexing the data so as to provide for context switching between one or more of a 
plurality of data flows (Ades: page 21, 35 and para 77, 289); and retaining states of said one or 
more of a plurality of data flows for said context switching (Ades: page 35-36, para 541) in order 
to allow messages to take the shortest path across the network (Ades: page 35, para 541). 

It would have been obvious at the time of the invention to one of ordinary skill in the art 
to create the network classifier as taught by Shipley to include flow identifiers and database as 
taught by Ades in order to allow messages to take shortest path across the network. (Ades: page 
35, para 541). 



Claims 18-19, 22-23 and 27-32 are rejected under 35 U.S.C. 103(a) as being 
unpatentable by U.S. Patent No. 6,119,236 by Shipley in view of U.S Patent No. 5,253,330 
by Ramacher. 

Regarding claim 18, the Shipley reference teaches the network classifier of claim 11. 

The Shipley reference fails to teach types of statistical classifiers. 

However, the Ramacher reference teaches a statistical classifier includes at least one of 
linear discriminant classifier, artificial neural network classifier (Ramacher: col. 1, lines 7-17; 
col. 3, lines 29-32), support vector machine classifier, Bayesian network classifier, decision tree 
classifier; and nearest neighbor classifier in order to perform classification with weighting 
associated with connections (Ramacher: col. 6, lines 29-34). 

It would have been obvious at the time of the invention to one of ordinary skill in the art 
to create the network classifier as taught by Shipley to include an artificial neural network 
classifier as taught by Ramacher in order to perform classification with weighting associated 
with connections (Ramacher: col. 6, lines 29-34). 

Regarding claim 22, the network classifier of claim 18 wherein the statistical classifier further 
generates a probability associated with a multitude of classes for the received data (Shipley: col. 
7, lines 1-50). 
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Regarding claim 23, the network classifier of claim 22 wherein the statistical classifier classifies 
the received data for at least one of the applications selected from a group consisting of intrusion 
detection (Shipley: col. 7, lines 1-50), content filtering, anti-spam, anti-virus, bandwidth 
management, quality of service provisioning, and network monitoring. 

Regarding claim 19, the Shipley reference teaches the network classifier of claim 1. 

The Shipley reference fails to teach types of statistical classifiers. 

However, the Ramacher reference teaches the network classifier of claim 1 8 wherein the 
artificial neural network classifier is configured to operate in accordance with an activation 
function selected from the group consisting of sigmoid function (Ramacher: col. 5, line 39), 
hyperbolic tan function (Ramacher: col. 1, line 23-27), Gaussian radial basis function, 
exponential radial basis function, and a non-linear function in order to perform classification 
with weighting associated with connections (Ramacher: col.. 6, lines 29-34). 

It would have been obvious at the time of the invention to one of ordinary skill in the art 
to create the network classifier as taught by Shipley to include an artificial neural network 
classifier as taught by Ramacher in order to perform classification with weighting associated 
with connections (Ramacher: col.. 6, lines 29-34). 

Regarding claim 27, the Shipley reference teaches the statistical classifier of claim 1, 

a lookup table configured to store weights for a multitude of events associated with the 

network data (Shipley: col. 7, lines 1-50). 

The Shipley reference fails to state an adder. 
However, the Ramacher reference teaches 

an adder coupled to add the weights it receives from the look-up table (Ramacher: col. 5, 
lines 36-43; col .2, lines 55-63); 

a register configured to store a value (Ramacher: Fig. 1); 
an accumulator (Ramacher: col. 5, lines 36-43); and 
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a multiplexer configured to deliver to the accumulator one of the added weights it 
receives from the adder at its first input terminal and the value it receives from the register at its 
second input terminal (Ramacher: col. 5, lines 36-43), the accumulator further configured to 
supply a summation of the added weights to the adder (Ramacher: col. 5 5 lines 36-43) in order to 
perform arithmetic operations with weighting associated with classifying connections 
(Ramacher: col. 6, lines 29-34). 

It would have been obvious at the time of the invention to one of ordinary skill in the art 
to create the network classifier as taught by Shipley to include arithmetic hardware as taught by 
Ramacher in order to perform arithmetic operations with weighting associated with classifying 
connections (Ramacher: col. 6, lines 29-34). 

Regarding claim 28, the Shipley reference teaches the statistical classifier in claim 1. 
The Shipley reference fails to state summation. 
However, the Ramacher reference teaches 

the integrated circuit of claim 27 furthermore comprising: a hardware logic block 
configured to apply one of linear and non-linear functions to the summation stored in the 
accumulator (Ramacher: col. 5, lines 36-43) in order to perform arithmetic operations with 
weighting associated with classifying connections (Ramacher: col. 6, lines 29-34). 

It would have been obvious at the time of the invention to one of ordinary skill in the art 
to create the network classifier as taught by Shipley to include arithmetic hardware as taught by 
Ramacher in order to perform arithmetic operations with weighting associated with classifying 
connections (Ramacher: col. 6, lines 29-34). 

Regarding claim 29, the Shipley reference teaches the statistical classifier in claim 1. 
The Shipley reference fails to state an accumulator. 
However, the Ramacher reference teaches 

the integrated circuit of claim 28 wherein the hardware logic block is configured to apply 
a non-linear function to the summation stored in the accumulator using lookup table (Ramacher: 
col. 5, lines 36-43) in order to perform arithmetic operations with weighting associated with 
classifying connections (Ramacher: col. 6, lines 29-34). 
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It would have been obvious at the time of the invention to one of ordinary skill in the art 
to create the network classifier as taught by Shipley to include arithmetic hardware as taught by 
Ramacher in order to perform arithmetic operations with. weighting associated with classifying 
connections (Ramacher: col. 6, lines 29-34). 

Regarding claim 30, the Shipley reference teaches the statistical classifier in claim 1. 
The Shipley reference fails to state a hardware block. 
However, the Ramacher reference teaches 

the integrated circuit of claim 28 wherein the hardware logic block is formed in a 
programmable device (Ramacher: col. 2, line 33-34) in order to perform arithmetic operations 
with weighting associated with classifying connections (Ramacher: col 6, lines 29-34). 

It would have been obvious at the time of the invention to one of ordinary skill in the art 
to create the network classifier as taught by Shipley to include arithmetic hardware as taught by 
Ramacher in order to perform arithmetic operations with weighting associated with classifying 
connections (Ramacher: col. 6, lines 29-34). 

Regarding claim 3 1 , the Shipley reference teaches the statistical classifier in claim 1 . 

The Shipley reference fails to state the integrated circuit. 
• However, the Ramacher reference teaches 

the integrated circuit of claim 28 wherein the register is programmable (Ramacher: col. 
5, lines 36-43) in order to perform arithmetic operations with weighting associated with 
classifying connections (Ramacher: col. 6, lines 29-34). 

It would have been obvious at the time of the invention to one of ordinary skill in the art 
to create the network classifier as taught by Shipley to include arithmetic hardware as taught by 
Ramacher in order to perform arithmetic operations with weighting associated with classifying 
connections (Ramacher: col. 6, lines 29-34). 

Regarding claim 32, the Shipley reference teaches the statistical classifier in claim 1. 
The Shipley reference fails to state the hardware logic block of 28. 
However, the Ramacher reference teaches 
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the integrated circuit of claim 28 wherein the hardware logic block is programmable 
(Ramacher: col. 5, lines 36-43) in order to perform arithmetic operations with weighting 
associated with classifying connections (Ramacher: col. 6, lines 29-34). 

It would have been obvious at the time of the invention to one of ordinary skill in the art 
to create the network classifier as taught by Shipley to include arithmetic hardware as taught by 
Ramacher in order to perform arithmetic operations with weighting associated with classifying 
connections (Ramacher: col. 6, lines 29-34). 

Claims 54-55, 58-59 are rejected under 35 U.S.C. 103(a) as being unpatentable by 
U.S. Patent No. 6,119,236 by Shipley in view of U.S Patent Publication No. 20020042274 by 
Ades in further view of U.S Patent No. 5,253,330 by Ramacher. 

Regarding claim 54, the modified Shipley reference teaches the network classifier of claim 53. 

The modified Shipley reference fails to teach types of statistical classifiers. 

However, the Ramacher reference teaches wherein the statistically classifying of the data 
is carried out using a statistical classifier that includes at least one of linear discriminant 
classifier, artificial neural network classifier (Ramacher: col. 1, lines 7-17; col. 3, lines 29-32), 
support vector machine classifier, Bayesian network classifier, decision tree classifier; and 
nearest neighbor classifier in order to perform classification with weighting associated with 
connections (Ramacher: col. 6, lines 29-34). 

It would have been obvious at the time of the invention to one of ordinary skill in the art 
to create the network classifier as taught by modified Shipley to include an artificial neural 
network classifier as taught by Ramacher in order to perform classification with weighting 
associated with connections (Ramacher: col. 6, lines 29-34). 

Regarding claim 55, the modified Shipley reference teaches the network classifier of claim 40. 

The modified Shipley reference fails to teach types of statistical classifiers. 

However, the Ramacher reference teaches wherein the artificial neural network classifier 
is configured to operate in accordance with an activation function selected from the group 
consisting of sigmoid function (Ramacher: col. 5, line 39), hyperbolic tan function (Ramacher: 
col. 1, line 23-27), Gaussian radial basis function, exponential radial basis function, and a non- 
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linear function in order to perform classification with weighting associated with connections 
(Ramacher: col.. 6, lines 29-34). 

It would have been obvious at the time of the invention to one of ordinary skill in the art 
to create the network classifier as taught by modified Shipley to include an artificial neural 
network classifier as taught by Ramacher in order to perform classification with weighting 
associated with connections (Ramacher: col.. 6, lines 29-34). 

Regarding claim 58, the method of claim 54 wherein the statistical classifier further generates a 
probability associated with a multitude of classes for the received data (Shipley: col. 7, lines 1- 
50). 

Regarding claim 59, the method of claim 58 wherein the statistical classifier classifies the 
received data for at least one of the applications selected from a group consisting of intrusion 
detection (Shipley: col. 7, lines 1-50), content filtering, antivirus, bandwidth management, 
quality of service provisioning, anti-spam, and network management. 

Claims 20-21 are rejected under 35 U.S.C. 103(a) as being unpatentable by U.S. 
Patent No. 6,119,236 by Shipley in view of U.S Patent No. 5,253,330 by Ramacher in 
further view of U.S Patent Publication No. 20030065632 by Hubey et al. 

Regarding claim 20, the modified Shipley reference teaches the network classifier of claim 18. 

The modified Shipley reference fails to teach a support vector machine classifier. 

However, the Hubey reference teaches wherein the support vector machine classifier 
(Hubey: page 7, para 102) is configured to operate in accordance with a kernel function selected 
from a group consisting of a linear projection function, polynomial function, piece- wise linear 
function, sigmoid function, Gaussian radial basis function, exponential radial basis function, and 
a non-linear transformation function (Hubey: page 7, para 102, 120) in order to classify data 
according to a set of different classification algorithms (Hubey: page 1, para 9). 

It would have been obvious at the time of the invention to one of ordinary skill in the art 
to create the network classifier as taught by the modified Shipley to include classification 
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algorithms as taught by Hubey in order to classify data according to a set of different 
classification algorithms (Hubey: page 1, para 9). 

Regarding claim 21, the modified Shipley reference teaches the network classifier of claim 18. 

The modified Shipley reference fails to teach types of distances. 

However, the Hubey reference teaches the network classifier of claim 1 8 wherein the 
nearest neighbor classifier is configured to operate in accordance with a distance metric selected 
from a group consisting of Euclidean distance, Mahalanobis distance, and Manhattan distance 
(Hubey: page 1, para 15) in order to classify data according to a set of different classification 
algorithms (Hubey: page 1, para 9). 

It would have been obvious at the time of the invention to one of ordinary skill in the art 
to create the network classifier as taught by the modified Shipley to include classification 
algorithms as taught by Hubey in order to classify data according to a set of different 
classification algorithms (Hubey: page 1, para 9). 

Claims 56-57 are rejected under 35 U.S.C. 103(a) as being unpatentable by U.S. 
Patent No. 6,119,236 by Shipley in view of U.S Patent Publication No. 20020042274 by Ades 
in further view of U.S Patent No. 5,253,330 by Ramacher in further view of U.S Patent 
Publication No. 20030065632 by Hubey et al. 

Regarding claim 56, the modified Shipley reference teaches the network classifier of claim 54. 

The modified Shipley reference fails to teach a support vector machine classifier. 

However, the Hubey reference teaches a support vector machine classifier (Hubey: page 
7, para 102) is configured to operate in accordance with a kernel function selected from a group 
consisting of a linear projection function, polynomial function, piece-wise linear function, 
sigmoid function, Gaussian radial basis function, exponential radial basis function, and a non- 
linear transformation function (Hubey: page 7, para 102, 120) in order to classify data according 
to a set of different classification algorithms (Hubey: page 1, para 9). 

It would have been obvious at the time of the invention to one of ordinary skill in the art 
to create the network classifier as taught by the modified Shipley to include classification 
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algorithms as taught by Hubey in order to classify data according to a set of different 
classification algorithms (Hubey: page 1 , para 9). 

Regarding claim 57, the modified Shipley reference teaches the network classifier of claim 54. 

The modified Shipley reference fails to teach types of distances. 

However, the Hubey reference teaches the method of claim 54 wherein the nearest 
neighbor classifier is configured to operate in accordance with a distance metric selected from a 
group consisting of Euclidean distance, Mahalanobis distance, and Manhattan distance (Hubey: 
page 1, para 15) in order to classify data according to a set of different classification algorithms 
(Hubey: page 1 , para 9). 

It would have been obvious at the time of the invention to one of ordinary skill in the art 
to create the network classifier as taught by the modified Shipley to include classification 
algorithms as taught by Hubey in order to classify data according to a set of different 
classification algorithms (Hubey: page 1, para 9). 
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Prior Art 



The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure: 

U. S. Patent No. 20020019870 by Chirashnya et al teaches a Bayesian network for 
classification of intrusive or threats to network entities (page 2, para 10, page 4, para 47-48, page 
6, para 61). 

U. S. Patent No. 6804201 by Gelenbe teaches packet classification with routing tables an 
protocols for correct ordering of packets upon retransmission (col. 1, lines 10-48, col. 5, lines 6- 
18, col. 8, line 15-22). 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Benjamin R Bruckart whose telephone number 571-272-3982. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Saleh Najjar can be reached on (571) 272-4006. The fax phone numbers for the 
organization where this application or proceeding is assigned are (571) 273-8300 for regular 
communications and after final communications. 

Any inquiry of a general nature or relating to the status of this application or proceeding 

should be directed to the examiner whose telephone number is 571-272-3982. 

Benjamin R Bruckart 
Examiner 

Art Unit 2155 _ 
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